Merge pull request #1783 from coltea/fix-app-perm

fix(app) editor perms修 复后台编辑页面普通用户无法获取知识库配置信息

Author: coltea

backend/handler/v1/app.go

@@ -35,10 +35,10 @@ func NewAppHandler(e *echo.Echo, baseHandler *handler.BaseHandler, logger *log.L
 		config:              config,
 	}
 
-	group := e.Group("/api/v1/app", h.auth.Authorize, h.auth.ValidateKBUserPerm(consts.UserKBPermissionFullControl))
-	group.GET("/detail", h.GetAppDetail)
-	group.PUT("", h.UpdateApp)
-	group.DELETE("", h.DeleteApp)
+	group := e.Group("/api/v1/app", h.auth.Authorize)
+	group.GET("/detail", h.GetAppDetail, h.auth.ValidateKBUserPerm(consts.UserKBPermissionDocManage))
+	group.PUT("", h.UpdateApp, h.auth.ValidateKBUserPerm(consts.UserKBPermissionFullControl))
+	group.DELETE("", h.DeleteApp, h.auth.ValidateKBUserPerm(consts.UserKBPermissionFullControl))
 
 	return h
 }
@@ -73,6 +73,9 @@ func (h *AppHandler) GetAppDetail(c echo.Context) error {
 	if err != nil {
 		return h.NewResponseWithError(c, "get app detail failed", err)
 	}
+	if authInfo := domain.GetAuthInfoFromCtx(ctx); authInfo != nil && authInfo.Permission == consts.UserKBPermissionDocManage {
+		app = h.usecase.SanitizeAppDetailForDocManage(app)
+	}
 	return h.NewResponseWithData(c, app)
 }
 

backend/usecase/app.go

@@ -587,6 +587,37 @@ func (u *AppUsecase) GetAppDetailByKBIDAndAppType(ctx context.Context, kbID stri
 	return appDetailResp, nil
 }
 
+func (u *AppUsecase) SanitizeAppDetailForDocManage(app *domain.AppDetailResp) *domain.AppDetailResp {
+	if app == nil {
+		return nil
+	}
+
+	sanitized := &domain.AppDetailResp{
+		ID:   app.ID,
+		KBID: app.KBID,
+		Name: app.Name,
+		Type: app.Type,
+	}
+
+	if app.Type != domain.AppTypeWeb {
+		return sanitized
+	}
+
+	sanitized.Settings = domain.AppSettingsResp{
+		ThemeMode:           app.Settings.ThemeMode,
+		ThemeAndStyle:       app.Settings.ThemeAndStyle,
+		CatalogSettings:     app.Settings.CatalogSettings,
+		WatermarkContent:    app.Settings.WatermarkContent,
+		WatermarkSetting:    app.Settings.WatermarkSetting,
+		CopySetting:         app.Settings.CopySetting,
+		ContributeSettings:  app.Settings.ContributeSettings,
+		ConversationSetting: app.Settings.ConversationSetting,
+		HomePageSetting:     app.Settings.HomePageSetting,
+	}
+
+	return sanitized
+}
+
 func (u *AppUsecase) GetMCPServerAppInfo(ctx context.Context, kbID string) (*domain.AppInfoResp, error) {
 	apiApp, err := u.repo.GetOrCreateAppByKBIDAndType(ctx, kbID, domain.AppTypeMcpServer)
 	if err != nil {